[ { "id": "01-system-context", "title": "Secrets Distribution Service — System Context", "layout": "context", "colWidth": 300, "system": { "label": "Secrets Distribution Service", "sub": "attest · issue · expire · revoke", "icon": "fa5_key" }, "groups": [ { "side": "top", "title": "Workloads that consume credentials", "nodes": [ { "id": "c-svc", "label": "Services, jobs, CI runners", "sub": "40,000 instances", "kind": "external", "rel": "attest · fetch", "dir": "in", "icon": "kubernetes" }, { "id": "c-legacy", "label": "Legacy processes", "sub": "file or proxy only", "kind": "external", "rel": "tmpfs file", "icon": "fa5_server" } ] }, { "side": "left", "title": "People", "nodes": [ { "id": "c-team", "label": "Service team", "kind": "actor", "rel": "grants", "dir": "in", "icon": "fa5_users" }, { "id": "c-owner", "label": "Secret owner", "kind": "actor", "rel": "rotation", "dir": "in", "icon": "fa5_user_tag" }, { "id": "c-resp", "label": "Security responder", "kind": "actor", "rel": "revoke", "dir": "in", "icon": "fa5_user_shield" }, { "id": "c-sre", "label": "Platform SRE", "kind": "actor", "rel": "operates", "dir": "in", "icon": "fa5_user_cog" } ] }, { "side": "right", "title": "Upstreams it serves, and the record it feeds", "nodes": [ { "id": "c-db", "label": "Databases", "sub": "PostgreSQL · MariaDB · MongoDB", "kind": "external", "rel": "accounts", "icon": "postgresql" }, { "id": "c-mq", "label": "Brokers, object store, APIs", "sub": "RabbitMQ · Kafka · Ceph RGW", "kind": "external", "rel": "users · tokens", "icon": "fa5_stream" }, { "id": "c-partner", "label": "Partner APIs", "sub": "keys it cannot mint", "kind": "external", "rel": "verify key", "icon": "fa5_globe" }, { "id": "c-rec", "label": "Records archive", "sub": "Object Lock · 7 y", "kind": "store", "rel": "audit", "kind2": "async", "icon": "fa5_archive" } ] }, { "side": "bottom", "title": "Authorities it relies on without owning", "nodes": [ { "id": "c-k8s", "label": "Kubernetes API servers", "sub": "token signer", "kind": "security", "rel": "TokenReview", "icon": "kubernetes" }, { "id": "c-hsm", "label": "HSMs and offline root", "sub": "key ceremony", "kind": "security", "rel": "seal", "dir": "in", "kind2": "batch", "icon": "fa5_microchip" }, { "id": "c-idp", "label": "Corporate IdP", "sub": "operators only", "kind": "external", "rel": "OIDC", "icon": "fa5_id_card" } ] } ], "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "02-high-level-architecture", "title": "High-Level Architecture — From Attestation to Expiry", "layout": "flow", "chain": false, "stages": [ { "title": "Workload", "nodes": [ { "id": "h-pod", "label": "Workload pod", "sub": "no secret in image", "kind": "external", "icon": "kubernetes" } ] }, { "title": "Node", "nodes": [ { "id": "h-spa", "label": "SPIRE agent", "sub": "attests pod", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "h-agent", "label": "Credential agent", "sub": "memory only", "kind": "app", "icon": "fa5_memory" } ] }, { "title": "Issuance tier", "nodes": [ { "id": "h-sps", "label": "SPIRE server", "sub": "per-site intermediate", "kind": "security", "icon": "fa5_id_badge" }, { "id": "h-gw", "label": "Issuance gateway", "sub": "stateless · Go", "kind": "integration", "icon": "fa5_door_closed" } ] }, { "title": "Engines", "nodes": [ { "id": "h-broker", "label": "Broker", "sub": "OpenBao · leases", "kind": "app", "icon": "fa5_key" }, { "id": "h-custody", "label": "Custody", "sub": "OpenBao · ciphertext", "kind": "app", "icon": "fa5_lock" } ] }, { "title": "Roots and upstreams", "nodes": [ { "id": "h-up", "label": "Upstreams", "sub": "accounts · keys", "kind": "external", "icon": "postgresql" }, { "id": "h-kms", "label": "KMS", "sub": "OpenBao · HSM seal", "kind": "security", "icon": "fa5_shield_alt" } ] }, { "title": "Record", "nodes": [ { "id": "h-audit", "label": "Audit stream", "sub": "Kafka", "kind": "queue", "icon": "kafka" }, { "id": "h-arch", "label": "Audit store", "sub": "ClickHouse · Object Lock", "kind": "store", "icon": "clickhouse" } ] } ], "edges": [ { "from": "h-agent", "to": "h-pod", "label": "socket · file" }, { "from": "h-spa", "to": "h-agent", "label": "delegated SVIDs" }, { "from": "h-spa", "to": "h-sps", "label": "node attest" }, { "from": "h-agent", "to": "h-gw", "label": "mTLS · session" }, { "from": "h-gw", "to": "h-broker", "label": "mint · renew" }, { "from": "h-gw", "to": "h-custody", "label": "read ciphertext" }, { "from": "h-broker", "to": "h-up", "label": "create · drop" }, { "from": "h-custody", "to": "h-kms", "label": "unwrap", "kind": "batch" }, { "from": "h-audit", "to": "h-arch", "label": "sealed", "kind": "async" } ], "note": "Every arrow into the gateway carries an attested identity. No arrow anywhere carries a credential used to obtain a credential.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "03-actors-and-journeys", "title": "Actors — Who It Serves and What Each of Them Gets to Do", "layout": "actors", "cardWidth": 270, "groups": [ { "title": "Consumers of credentials", "kind": "boundary", "actors": [ { "id": "a-team", "label": "Service team", "sub": "≈ 300 teams", "icon": "fa5_users", "goal": "Ship a service whose repository, image and pipeline hold no password at all.", "journeys": [ { "id": "j-ship", "label": "Ship a service with no stored password" }, { "label": "Move a secret from custody to brokered" } ] }, { "id": "a-wl", "label": "Workload", "sub": "40,000 instances", "kind": "platform", "icon": "kubernetes", "goal": "Have a working credential before my first query and a fresh one before it lapses.", "journeys": [ { "label": "Attest and open a session" }, { "label": "Renew without a restart" } ] }, { "id": "a-legacy", "label": "Legacy consumer", "sub": "cannot be modified", "kind": "external", "icon": "fa5_server", "goal": "Keep reading the file I already read, and not break when it changes.", "journeys": [ { "label": "Read a credential from tmpfs" } ] } ] }, { "title": "Owners and responders", "kind": "trust", "actors": [ { "id": "a-owner", "label": "Secret owner", "sub": "3,200 custodial secrets", "icon": "fa5_user_tag", "goal": "Rotate a partner key with no outage, and know who still holds the old one.", "journeys": [ { "id": "j-rotate", "label": "Rotate a key past a straggler" } ] }, { "id": "a-resp", "label": "Security responder", "sub": "on call", "icon": "fa5_user_shield", "goal": "Say who had it, then make it useless, within minutes.", "journeys": [ { "id": "j-contain", "label": "Contain a leaked credential" }, { "label": "Read a secret under break-glass" } ] }, { "id": "a-aud", "label": "Auditor", "sub": "internal and external", "icon": "fa5_clipboard_check", "goal": "Show that every read had a named reader, and no one could erase it.", "journeys": [ { "label": "Answer who read a secret" } ] } ] }, { "title": "People who run it", "kind": "onprem", "actors": [ { "id": "a-sre", "label": "Platform SRE", "sub": "no standing read", "icon": "fa5_user_cog", "goal": "Keep issuance up through a restart storm without extending a single lease.", "journeys": [ { "label": "Absorb a node-pool replacement" }, { "label": "Restore a store without reviving a credential" } ] }, { "id": "a-kc", "label": "Key custodian", "sub": "security office", "icon": "fa5_user_lock", "goal": "Hold the root key so that the platform team cannot use it alone.", "journeys": [ { "label": "Rotate an envelope key" }, { "label": "Seal a partition on command" } ] } ] } ], "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "04-journey-ship-a-service-with-no-stored-password", "title": "Journey — A Service Team Ships With No Stored Password", "layout": "journey", "actor": { "label": "Service team", "sub": "orders-api", "icon": "fa5_users", "goal": "Reach PostgreSQL and a partner API with nothing stored", "trigger": "New service, production launch in two weeks", "success": "Pods ready; no secret in repo, image or CI" }, "phases": [ { "title": "Declare" }, { "title": "Review" }, { "title": "Deploy" }, { "title": "First query", "moment": true }, { "title": "Hotfix", "moment": true }, { "title": "Steady state" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Adds identity and grants" } ], [ { "label": "Reads blast-radius diff" } ], [ { "label": "Merges and deploys" } ], [ { "label": "Watches pods go ready" } ], [ { "label": "Pushes image by hand" } ], [ { "label": "Forgets it exists" } ] ] }, { "title": "System behind it", "kind": "system", "cells": [ [ { "label": "Registry repo", "icon": "git" } ], [ { "label": "Registry compiler", "icon": "fa5_code" } ], [ { "label": "Argo CD · SPIRE entry", "icon": "argocd" } ], [ { "label": "Issuance gateway", "icon": "fa5_door_closed" } ], [ { "label": "Digest selector", "icon": "fa5_fingerprint" } ], [ { "label": "Credential agent", "icon": "fa5_memory" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Confident", "Unsure", "Frustrated" ], "points": [ "Unsure", "Unsure", "Confident", "Confident", "Frustrated", "Confident" ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "Which role name?" } ], [ { "label": "Custodial needs 2nd approver" } ], [], [], [ { "label": "Pod denied: unknown digest" } ], [] ] }, { "title": "What the platform gives", "kind": "gain", "cells": [ [ { "label": "Lint names missing fields" } ], [ { "label": "Reachable set in the PR" } ], [ { "label": "Digest pinned by CD" } ], [ { "label": "Credential before main()" } ], [ { "label": "Denial says why" } ], [ { "label": "Renewal is invisible" } ] ] } ], "chain": true, "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "05-journey-contain-a-leaked-credential", "title": "Journey — A Responder Contains a Leaked Credential", "layout": "journey", "actor": { "label": "Security responder", "sub": "on call", "icon": "fa5_user_shield", "goal": "Make a leaked database password useless", "trigger": "Password found in a support ticket attachment", "success": "Account gone at the upstream, readers named" }, "phases": [ { "title": "Alert" }, { "title": "Identify" }, { "title": "Scope" }, { "title": "Revoke", "moment": true }, { "title": "Confirm", "moment": true }, { "title": "Close" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Opens the ticket" } ], [ { "label": "Looks up the username" } ], [ { "label": "Chooses identity scope" } ], [ { "label": "Revokes orders-api leases" } ], [ { "label": "Waits on one replica" } ], [ { "label": "Files the review" } ] ] }, { "title": "System behind it", "kind": "system", "cells": [ [ { "label": "Alertmanager", "icon": "prometheus" } ], [ { "label": "Audit query", "icon": "clickhouse" } ], [ { "label": "Inventory", "icon": "fa5_sitemap" } ], [ { "label": "Revocation API", "icon": "fa5_ban" } ], [ { "label": "Upstream check", "icon": "postgresql" } ], [ { "label": "Exception register", "icon": "fa5_list_alt" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "In control", "Unsure", "Alarmed" ], "points": [ "Alarmed", "Unsure", "Unsure", "In control", "Alarmed", "In control" ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [ { "label": "A password, no owner" } ], [], [ { "label": "Too wide breaks orders" } ], [], [ { "label": "Revocation pending" } ], [] ] }, { "title": "What the platform gives", "kind": "gain", "cells": [ [ { "label": "Already expiring" } ], [ { "label": "Username names the lease" } ], [ { "label": "Reachable set per scope" } ], [ { "label": "Agents re-mint in seconds" } ], [ { "label": "Uncontained, not success" } ], [ { "label": "Readers in one query" } ] ] } ], "chain": true, "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "06-journey-rotate-a-key-past-a-straggler", "title": "Journey — A Secret Owner Rotates a Partner Key Past a Straggler", "layout": "journey", "actor": { "label": "Secret owner", "sub": "payments partner key", "icon": "fa5_user_tag", "goal": "Replace a partner API key with no outage", "trigger": "Key reaches 80% of its 90-day maximum age", "success": "Old key destroyed, nobody broken, nobody forgotten" }, "phases": [ { "title": "Due" }, { "title": "Stage" }, { "title": "Verify", "moment": true }, { "title": "Overlap" }, { "title": "Straggler", "moment": true }, { "title": "Retire" } ], "lanes": [ { "title": "What they do", "kind": "step", "cells": [ [ { "label": "Gets overdue warning" } ], [ { "label": "Starts the rotation" } ], [ { "label": "Watches the test call" } ], [ { "label": "Watches consumers move" } ], [ { "label": "Chases a monthly job" } ], [ { "label": "Confirms destruction" } ] ] }, { "title": "System behind it", "kind": "system", "cells": [ [ { "label": "Inventory", "icon": "fa5_sitemap" } ], [ { "label": "Rotation controller", "icon": "fa5_sync_alt" } ], [ { "label": "Partner API", "icon": "fa5_globe" } ], [ { "label": "Agent version reports", "icon": "fa5_memory" } ], [ { "label": "Observed-use report", "icon": "fa5_eye" } ], [ { "label": "Custody · both sites", "icon": "fa5_lock" } ] ] }, { "title": "How it feels", "kind": "emotion", "levels": [ "Confident", "Unsure", "Frustrated" ], "points": [ "Unsure", "Confident", "Unsure", "Confident", "Frustrated", "Confident" ] }, { "title": "Where it hurts", "kind": "pain", "cells": [ [], [ { "label": "Partner allows two keys" } ], [ { "label": "Test call rate-limited" } ], [], [ { "label": "Job reads once a month" } ], [] ] }, { "title": "What the platform gives", "kind": "gain", "cells": [ [ { "label": "Warned at 80% of age" } ], [ { "label": "Both keys valid 24 h+" } ], [ { "label": "Abort keeps old key" } ], [ { "label": "Version held per pod" } ], [ { "label": "Straggler named · day 7" } ], [ { "label": "Destruction audited" } ] ] } ], "chain": true, "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "07-layered-architecture", "title": "Layered Architecture — Eight Layers, One Direction of Trust", "layout": "bands", "layerHeaderWidth": 150, "canvas": { "width": 1560 }, "bands": [ { "name": "Workloads", "nodes": [ { "id": "l-svc", "label": "Services", "sub": "Kubernetes", "kind": "external", "icon": "kubernetes" }, { "id": "l-batch", "label": "Batch and CI", "sub": "ephemeral pods", "kind": "external", "icon": "fa5_cogs" }, { "id": "l-legacy", "label": "Legacy processes", "sub": "unmodifiable", "kind": "external", "icon": "fa5_server" } ] }, { "name": "Delivery", "nodes": [ { "id": "l-sock", "label": "Local socket", "sub": "default mode", "kind": "integration", "icon": "fa5_plug" }, { "id": "l-file", "label": "tmpfs file", "sub": "0400 · pod UID", "kind": "integration", "icon": "fa5_file_alt" }, { "id": "l-proxy", "label": "Credential proxy", "sub": "Envoy · HTTP only", "kind": "integration", "icon": "envoy" } ] }, { "name": "Node", "nodes": [ { "id": "l-agent", "label": "Credential agent", "sub": "Go · memory only", "kind": "app", "icon": "fa5_memory" }, { "id": "l-spa", "label": "SPIRE agent", "sub": "delegated identity", "kind": "security", "icon": "fa5_fingerprint" } ] }, { "name": "Issuance", "nodes": [ { "id": "l-gw", "label": "Issuance gateway", "sub": "bind · check · audit", "kind": "integration", "icon": "fa5_door_closed" }, { "id": "l-sps", "label": "SPIRE server", "sub": "trust domain per env", "kind": "security", "icon": "fa5_id_badge" } ] }, { "name": "Engines", "nodes": [ { "id": "l-broker", "label": "Broker shards", "sub": "OpenBao · leases", "kind": "app", "icon": "fa5_key" }, { "id": "l-custody", "label": "Custody", "sub": "OpenBao · KV v2 · transit", "kind": "app", "icon": "fa5_lock" } ] }, { "name": "Root of trust", "nodes": [ { "id": "l-kms", "label": "KMS cluster", "sub": "key custodians", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "l-hsm", "label": "HSM pair", "sub": "PKCS#11 seal", "kind": "security", "icon": "fa5_microchip" } ] }, { "name": "Governance", "nodes": [ { "id": "l-reg", "label": "Registry", "sub": "Git · reviewed", "kind": "store", "icon": "git" }, { "id": "l-inv", "label": "Inventory", "sub": "blast radius", "kind": "app", "icon": "fa5_sitemap" }, { "id": "l-rot", "label": "Rotation controller", "kind": "app", "icon": "fa5_sync_alt" }, { "id": "l-rec", "label": "Reconciler", "sub": "hourly", "kind": "app", "icon": "fa5_equals" }, { "id": "l-acc", "label": "Access broker", "sub": "break-glass", "kind": "security", "icon": "fa5_user_lock" } ] }, { "name": "Record", "nodes": [ { "id": "l-kafka", "label": "Audit stream", "sub": "Kafka · acks=all", "kind": "queue", "icon": "kafka" }, { "id": "l-ch", "label": "Audit query", "sub": "ClickHouse · 400 d", "kind": "store", "icon": "clickhouse" }, { "id": "l-lock", "label": "Audit archive", "sub": "Ceph Object Lock · 7 y", "kind": "store", "icon": "fa5_archive" } ] } ], "note": "A layer calls the layer below it, never above. Governance writes policy into the engines and is never on the issuance path.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "08-node-and-delivery", "title": "One Node — Attestation, Agent and Three Delivery Modes", "layout": "nested", "boxes": [ { "title": "One node and the enclave it reaches", "kind": "plain", "dir": "row", "children": [ { "title": "Kubernetes node", "kind": "onprem", "dir": "row", "children": [ { "title": "Pods", "kind": "plain", "dir": "col", "children": [ { "title": "Pod · orders-api", "kind": "boundary", "dir": "col", "nodes": [ { "id": "n-app", "label": "Application", "sub": "reads socket", "kind": "external", "icon": "fa5_cube" }, { "id": "n-envoy", "label": "Credential proxy", "sub": "Envoy · fed over SDS", "kind": "integration", "icon": "envoy" } ] }, { "title": "Pod · legacy-billing", "kind": "boundary", "dir": "col", "nodes": [ { "id": "n-file", "label": "tmpfs volume", "sub": "atomic write · 0400", "kind": "store", "icon": "fa5_file_alt" }, { "id": "n-legacy", "label": "Legacy process", "sub": "reads file", "kind": "external", "icon": "fa5_server" } ] } ] }, { "title": "Node daemons", "kind": "trust", "dir": "col", "nodes": [ { "id": "n-agent", "label": "Credential agent", "sub": "CSI · socket · SDS", "kind": "app", "icon": "fa5_memory" }, { "id": "n-spa", "label": "SPIRE agent", "sub": "Delegated Identity API", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "n-kubelet", "label": "kubelet", "sub": "pod · image digest", "kind": "platform", "icon": "kubernetes" } ] } ] }, { "title": "Security enclave", "kind": "trust", "dir": "col", "nodes": [ { "id": "n-gw", "label": "Issuance gateway", "sub": "partition endpoints", "kind": "integration", "icon": "fa5_door_closed" }, { "id": "n-sps", "label": "SPIRE server", "sub": "site intermediate", "kind": "security", "icon": "fa5_id_badge" } ] } ] } ], "edges": [ { "from": "n-app", "to": "n-agent" }, { "from": "n-envoy", "to": "n-agent" }, { "from": "n-agent", "to": "n-file" }, { "from": "n-legacy", "to": "n-file" }, { "from": "n-spa", "to": "n-agent", "label": "SVIDs" }, { "from": "n-spa", "to": "n-kubelet", "label": "attest" }, { "from": "n-agent", "to": "n-gw", "label": "mTLS as the pod" } ], "note": "No credential reaches an environment variable. In proxy mode the application never sees the key it uses. Node attestation to the SPIRE server is on view 10.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" }, "canvas": { "width": 1120 } }, { "id": "09-partition-containers", "title": "One Partition — Production at Site A", "layout": "nested", "boxes": [ { "title": "Production partition · site A", "kind": "onprem", "dir": "row", "children": [ { "title": "Estate", "kind": "boundary", "dir": "col", "nodes": [ { "id": "p-agents", "label": "Credential agents", "sub": "production nodes", "kind": "app", "icon": "fa5_memory" } ] }, { "title": "Enclave front", "kind": "plain", "dir": "col", "children": [ { "title": "Issuance tier", "kind": "boundary", "dir": "col", "nodes": [ { "id": "p-sps", "label": "SPIRE server", "sub": "3 · Patroni datastore", "kind": "security", "icon": "fa5_id_badge" }, { "id": "p-gw", "label": "Issuance gateway", "sub": "6 · stateless", "kind": "integration", "icon": "fa5_door_closed" } ] }, { "title": "Root of trust · custodians", "kind": "trust", "dir": "col", "nodes": [ { "id": "p-kms", "label": "KMS", "sub": "OpenBao · HSM seal", "kind": "security", "icon": "fa5_shield_alt" } ] } ] }, { "title": "Engines", "kind": "boundary", "dir": "col", "nodes": [ { "id": "p-bdata", "label": "Broker · data stores", "sub": "OpenBao · 5 voters", "kind": "app", "icon": "fa5_key" }, { "id": "p-bmsg", "label": "Broker · messaging", "sub": "OpenBao · 5 voters", "kind": "app", "icon": "fa5_key" }, { "id": "p-cust", "label": "Custody", "sub": "OpenBao · 5 voters", "kind": "app", "icon": "fa5_lock" } ] }, { "title": "Upstreams · not owned", "kind": "boundary", "dir": "col", "nodes": [ { "id": "p-pg", "label": "PostgreSQL fleet", "kind": "external", "icon": "postgresql" }, { "id": "p-rmq", "label": "RabbitMQ", "kind": "external", "icon": "fa5_stream" } ] } ] } ], "edges": [ { "from": "p-agents", "to": "p-gw", "label": "mTLS" }, { "from": "p-gw", "to": "p-bdata", "label": "mint · renew" }, { "from": "p-gw", "to": "p-cust", "label": "ciphertext" }, { "from": "p-gw", "to": "p-kms", "label": "unwrap" }, { "from": "p-bdata", "to": "p-pg", "label": "CREATE ROLE" }, { "from": "p-bmsg", "to": "p-rmq", "label": "users API" } ], "note": "Every read and mint also writes to the audit stream (view 15). Site B holds an identical partition with its own keys.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "10-chain-of-trust", "title": "Chain of Trust — Where Secret Zero Actually Ends", "layout": "flow", "chain": false, "stageGap": 120, "stages": [ { "title": "Hardware and ceremony", "nodes": [ { "id": "t-root", "label": "Offline root CA", "sub": "HSM · per environment", "kind": "security", "icon": "fa5_microchip" }, { "id": "t-sakey", "label": "Token signing key", "sub": "kube-apiserver", "kind": "security", "icon": "kubernetes" } ] }, { "title": "Authorities", "nodes": [ { "id": "t-sps", "label": "SPIRE server", "sub": "site intermediate", "kind": "security", "icon": "fa5_id_badge" }, { "id": "t-api", "label": "kube-apiserver", "sub": "TokenReview", "kind": "platform", "icon": "kubernetes" } ] }, { "title": "Node", "nodes": [ { "id": "t-spa", "label": "SPIRE agent", "sub": "node SVID", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "t-join", "label": "Join token", "sub": "legacy VMs · registered", "kind": "risk", "icon": "fa5_exclamation_triangle" } ] }, { "title": "Workload", "nodes": [ { "id": "t-svid", "label": "Workload SVIDs", "sub": "X.509 1 h · JWT 5 min", "kind": "security", "icon": "fa5_id_card" } ] }, { "title": "Session", "nodes": [ { "id": "t-sess", "label": "Session token", "sub": "15 min · key-bound", "kind": "integration", "icon": "fa5_door_closed" } ] }, { "title": "Credential", "nodes": [ { "id": "t-lease", "label": "Brokered lease", "sub": "30 min · ≤ 12 h", "kind": "app", "icon": "fa5_key" }, { "id": "t-cust", "label": "Custodial version", "sub": "max age 90 d", "kind": "app", "icon": "fa5_lock" } ] } ], "edges": [ { "from": "t-root", "to": "t-sps", "label": "signs", "kind": "batch" }, { "from": "t-sakey", "to": "t-api" }, { "from": "t-sps", "to": "t-api", "label": "PSAT" }, { "from": "t-sps", "to": "t-spa", "label": "node SVID" }, { "from": "t-join", "to": "t-spa", "label": "single use", "kind": "error" }, { "from": "t-spa", "to": "t-svid", "label": "attests" }, { "from": "t-svid", "to": "t-sess", "label": "exchange" }, { "from": "t-sess", "to": "t-lease", "label": "mint" }, { "from": "t-sess", "to": "t-cust", "label": "read" } ], "note": "Everything right of the first column expires on its own. Everything in red is written in the exception register.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "11-integration-surface", "title": "Integration Surface — Every Interface In and Out", "layout": "hub", "left": { "title": "Callers", "nodes": [ { "id": "i-agent", "label": "Credential agents", "kind": "app", "rel": "gRPC · mTLS", "icon": "fa5_memory" }, { "id": "i-ops", "label": "Operators and responders", "kind": "actor", "rel": "OIDC · WebAuthn", "icon": "fa5_user_shield" }, { "id": "i-ctl", "label": "Registry and controllers", "sub": "signed bundles · SVIDs", "kind": "app", "rel": "mTLS", "icon": "fa5_sync_alt" } ] }, "centre": { "title": "Platform", "nodes": [ { "id": "i-core", "label": "Secrets Distribution Service", "sub": "gateway · engines · governance", "kind": "app", "icon": "fa5_key" } ] }, "right": { "title": "What it reaches", "nodes": [ { "id": "i-db", "label": "Databases", "sub": "PostgreSQL · MariaDB · MongoDB", "kind": "external", "rel": "SQL", "dir": "out", "icon": "postgresql" }, { "id": "i-mq", "label": "Brokers, stores and APIs", "sub": "RabbitMQ · Kafka · Ceph RGW · HTTP", "kind": "external", "rel": "admin APIs", "dir": "out", "icon": "fa5_stream" }, { "id": "i-audit", "label": "Audit stream", "sub": "Kafka", "kind": "queue", "rel": "events", "dir": "out", "kind2": "async", "icon": "kafka" } ] }, "note": "Workloads never call the platform directly. The agent is the only client that holds a session.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "12-anatomy-of-a-credential-request", "title": "Anatomy of One Request — Six Checks, In This Order", "layout": "flow", "chain": false, "align": "top", "stages": [ { "title": "Handshake", "nodes": [ { "id": "r-tls", "label": "Chains to env bundle", "kind": "decision", "icon": "fa5_handshake" }, { "id": "r-x1", "label": "TLS refused", "kind": "risk", "icon": "fa5_ban" } ] }, { "title": "Binding", "nodes": [ { "id": "r-bind", "label": "Session bound to key", "kind": "decision", "icon": "fa5_link" }, { "id": "r-x2", "label": "401 · unbound", "kind": "risk", "icon": "fa5_ban" } ] }, { "title": "Generation", "nodes": [ { "id": "r-gen", "label": "Generation current", "kind": "decision", "icon": "fa5_history" }, { "id": "r-x3", "label": "401 · re-attest", "kind": "risk", "icon": "fa5_ban" } ] }, { "title": "Admission", "nodes": [ { "id": "r-lane", "label": "Lane and rate", "kind": "decision", "icon": "fa5_tachometer_alt" }, { "id": "r-x4", "label": "429 · retry-after", "kind": "risk", "icon": "fa5_hourglass_half" } ] }, { "title": "Policy", "nodes": [ { "id": "r-pol", "label": "OpenBao ACL", "kind": "decision", "icon": "fa5_balance_scale" }, { "id": "r-x5", "label": "403 · audited", "kind": "risk", "icon": "fa5_ban" } ] }, { "title": "Audit posture", "nodes": [ { "id": "r-aud", "label": "Recorded first", "kind": "decision", "icon": "fa5_receipt" }, { "id": "r-x6", "label": "503 · fail closed", "kind": "risk", "icon": "fa5_ban" } ] }, { "title": "Serve", "nodes": [ { "id": "r-out", "label": "Released", "sub": "expiry attached", "kind": "opportunity", "icon": "fa5_check_circle" } ] } ], "edges": [ { "from": "r-tls", "to": "r-bind" }, { "from": "r-bind", "to": "r-gen" }, { "from": "r-gen", "to": "r-lane" }, { "from": "r-lane", "to": "r-pol" }, { "from": "r-pol", "to": "r-aud" }, { "from": "r-aud", "to": "r-out" }, { "from": "r-tls", "to": "r-x1", "kind": "error" }, { "from": "r-bind", "to": "r-x2", "kind": "error" }, { "from": "r-gen", "to": "r-x3", "kind": "error" }, { "from": "r-lane", "to": "r-x4", "kind": "error" }, { "from": "r-pol", "to": "r-x5", "kind": "error" }, { "from": "r-aud", "to": "r-x6", "kind": "error" } ], "note": "Environment is settled in the handshake, before any policy exists to be wrong. Cheap checks run first; the audit write runs last.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "13-four-stores", "title": "Four Stores, Four Guarantees — and the Intent Behind Them", "layout": "nested", "boxes": [ { "title": "State by what losing it costs", "kind": "plain", "dir": "row", "children": [ { "title": "Custodial material · RPO 0", "kind": "trust", "dir": "col", "nodes": [ { "id": "s-kv", "label": "Versioned ciphertext", "sub": "OpenBao KV v2 · both sites", "kind": "store", "icon": "fa5_lock" }, { "id": "s-transit", "label": "Non-exportable keys", "sub": "OpenBao transit", "kind": "store", "icon": "fa5_file_signature" }, { "id": "s-kek", "label": "Envelope keys", "sub": "KMS · per site", "kind": "store", "icon": "fa5_shield_alt" } ] }, { "title": "Lease and identity · RPO 0", "kind": "boundary", "dir": "col", "nodes": [ { "id": "s-raft", "label": "Leases and sessions", "sub": "OpenBao Raft · per site", "kind": "store", "icon": "fa5_key" }, { "id": "s-spdb", "label": "Identity entries", "sub": "SPIRE · PostgreSQL", "kind": "store", "icon": "postgresql" }, { "id": "s-gen", "label": "Restore generation", "sub": "KMS · not restorable", "kind": "store", "icon": "fa5_history" } ] }, { "title": "Audit · RPO ≤ 30 s", "kind": "boundary", "dir": "col", "nodes": [ { "id": "s-kafka", "label": "Audit stream", "sub": "Kafka · 7 d", "kind": "queue", "icon": "kafka" }, { "id": "s-ch", "label": "Queryable audit", "sub": "ClickHouse · 400 d", "kind": "store", "icon": "clickhouse" }, { "id": "s-lock", "label": "Archive", "sub": "Object Lock · 7 y", "kind": "store", "icon": "fa5_archive" } ] }, { "title": "Agent cache · no RPO", "kind": "boundary", "dir": "col", "nodes": [ { "id": "s-mem", "label": "Credential cache", "sub": "agent memory · never disk", "kind": "store", "icon": "fa5_memory" } ] }, { "title": "Intent · not secret", "kind": "boundary", "dir": "col", "nodes": [ { "id": "s-reg", "label": "Registry", "sub": "Forgejo · signed commits", "kind": "store", "icon": "git" }, { "id": "s-inv", "label": "Inventory", "sub": "PostgreSQL · derived", "kind": "store", "icon": "postgresql" } ] } ] } ], "note": "Nothing in the audit, cache or intent columns can decrypt anything in the first column.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "14-data-model", "title": "Data Model — Identities, Grants, Leases and Versions", "layout": "er", "canvas": { "width": 1760, "cols": 5 }, "rowGap": 250, "entities": [ { "id": "e-exc", "name": "exception", "kind": "risk", "row": 0, "col": 0, "attrs": [ "exception_id PK", "class secret_zero|irrevocable|manual|unmodifiable", "subject_ref", "owner NOT NULL", "review_by NOT NULL" ] }, { "id": "e-wid", "name": "workload_identity", "kind": "store", "row": 0, "col": 1, "attrs": [ "spiffe_id PK", "environment", "cluster, namespace, service_account", "image_policy digest from CD", "owner_team NOT NULL", "delegate_of registered only" ] }, { "id": "e-grant", "name": "grant", "kind": "store", "row": 0, "col": 2, "attrs": [ "grant_id PK", "spiffe_id FK", "target secret|role, exact path", "approvals 2 for prod custody", "registry_commit" ] }, { "id": "e-secret", "name": "secret", "kind": "store", "row": 0, "col": 3, "attrs": [ "secret_path PK", "environment", "owner NOT NULL", "rotation automated|manual", "max_age_days", "exportable bool", "consumers" ] }, { "id": "e-ver", "name": "secret_version", "kind": "store", "row": 0, "col": 4, "attrs": [ "secret_path FK", "version_id PK", "kek_version", "state staged|active|overlap|retired", "last_observed_use", "destroy_after" ] }, { "id": "e-audit", "name": "audit_event", "kind": "store", "row": 1, "col": 0, "attrs": [ "event_id PK", "ts, class, decision", "actor spiffe_id or human", "coordinates node, pod, image", "target path, lease_id", "gap_marker bool" ] }, { "id": "e-sess", "name": "session", "kind": "store", "row": 1, "col": 1, "attrs": [ "token_accessor PK", "spiffe_id FK", "node, pod_uid", "key_thumbprint", "generation FK", "expires_at ≤ 12 h total" ] }, { "id": "e-lease", "name": "lease", "kind": "store", "row": 1, "col": 2, "attrs": [ "lease_id PK", "token_accessor FK", "role_path FK", "upstream_handle username", "issued_at, expires_at", "state live|pending_revoke|closed" ] }, { "id": "e-role", "name": "role", "kind": "store", "row": 1, "col": 3, "attrs": [ "role_path PK", "upstream_id FK", "privileges_ref", "default_ttl, max_ttl, max_total", "revocation method|irrevocable", "per_instance, lease_cap" ] }, { "id": "e-rot", "name": "rotation", "kind": "store", "row": 1, "col": 4, "attrs": [ "rotation_id PK", "from_version, to_version", "state staged|verified|overlap|retired|aborted", "overlap_until", "stragglers" ] }, { "id": "e-part", "name": "partition", "kind": "store", "row": 2, "col": 1, "attrs": [ "partition_id PK", "environment, site, shape", "generation advanced on restore", "kek_key_id" ] }, { "id": "e-up", "name": "upstream", "kind": "store", "row": 2, "col": 3, "attrs": [ "upstream_id PK", "environment one only", "type, endpoint", "admin_credential never readable", "mint_budget_per_s" ] } ], "relations": [ { "from": "e-exc", "to": "e-wid", "label": "registers", "from_side": "e", "to_side": "w", "kind": "optional" }, { "from": "e-wid", "to": "e-grant", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "e-grant", "to": "e-secret", "label": "N : 1", "from_side": "e", "to_side": "w", "kind": "optional" }, { "from": "e-secret", "to": "e-ver", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "e-ver", "to": "e-rot", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-wid", "to": "e-sess", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "e-sess", "to": "e-audit", "label": "1 : N", "from_side": "w", "to_side": "e", "kind": "optional" }, { "from": "e-sess", "to": "e-lease", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "e-role", "to": "e-lease", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "e-grant", "to": "e-role", "label": "N : 1", "from_side": "s3", "to_side": "n1", "kind": "optional" }, { "from": "e-up", "to": "e-role", "label": "1 : N", "from_side": "n", "to_side": "s" }, { "from": "e-part", "to": "e-sess", "label": "1 : N", "from_side": "n", "to_side": "s" } ], "note": "Leases and sessions live in OpenBao; identities in SPIRE; secrets, roles and grants are compiled from the registry into both and indexed by the inventory.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "15-audit-pipeline", "title": "Audit Pipeline — Recorded Before Returned, Kept Beyond the Platform", "layout": "flow", "chain": false, "stages": [ { "title": "Emit", "nodes": [ { "id": "a-bao", "label": "OpenBao audit device", "sub": "every request", "kind": "app", "icon": "fa5_key" }, { "id": "a-kms", "label": "KMS audit device", "sub": "every unwrap", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "a-gw", "label": "Issuance gateway", "sub": "custodial · human", "kind": "integration", "icon": "fa5_door_closed" } ] }, { "title": "Commit locally", "nodes": [ { "id": "a-file", "label": "Local audit log", "sub": "NVMe · fsync", "kind": "store", "icon": "fa5_hdd" } ] }, { "title": "Ship", "nodes": [ { "id": "a-fb", "label": "Fluent Bit", "sub": "disk buffer", "kind": "integration", "icon": "fa5_stream" }, { "id": "a-gap", "label": "Gap marker", "sub": "written on overflow", "kind": "risk", "icon": "fa5_exclamation_triangle" } ] }, { "title": "Stream", "nodes": [ { "id": "a-kafka", "label": "Audit stream", "sub": "Kafka · acks=all", "kind": "queue", "icon": "kafka" } ] }, { "title": "Seal and keep", "nodes": [ { "id": "a-ch", "label": "ClickHouse", "sub": "400 days", "kind": "store", "icon": "clickhouse" }, { "id": "a-seal", "label": "Chain sealer", "sub": "hash chain · anchors", "kind": "security", "icon": "fa5_link" }, { "id": "a-lock", "label": "Ceph Object Lock", "sub": "compliance · 7 y", "kind": "store", "icon": "fa5_archive" } ] }, { "title": "Ask", "nodes": [ { "id": "a-who", "label": "Who read it", "sub": "one query", "kind": "app", "icon": "fa5_search" }, { "id": "a-leak", "label": "Leak detector", "sub": "phase 3", "kind": "app", "icon": "fa5_eye" } ] } ], "edges": [ { "from": "a-bao", "to": "a-file", "label": "before reply" }, { "from": "a-kms", "to": "a-file" }, { "from": "a-file", "to": "a-fb", "label": "tail" }, { "from": "a-fb", "to": "a-gap", "kind": "error" }, { "from": "a-fb", "to": "a-kafka", "kind": "async" }, { "from": "a-gw", "to": "a-kafka", "label": "sync · quorum", "route": "gutter" }, { "from": "a-kafka", "to": "a-seal" }, { "from": "a-seal", "to": "a-lock", "kind": "batch" }, { "from": "a-kafka", "to": "a-ch", "kind": "async" }, { "from": "a-ch", "to": "a-who" }, { "from": "a-ch", "to": "a-leak", "kind": "batch" } ], "note": "Records carry names, coordinates and decisions — never material. A scrubber test in CI fails any build that logs a secret-shaped value.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "16-registry-to-policy", "title": "Registry to Policy — How a Grant Becomes Enforceable", "layout": "flow", "chain": true, "stages": [ { "title": "Declare", "nodes": [ { "id": "g-pr", "label": "Registry change", "sub": "identity · secret · role · grant", "kind": "store", "icon": "git" } ] }, { "title": "Validate", "nodes": [ { "id": "g-lint", "label": "Owner and schema", "sub": "no owner, no entry", "kind": "app", "icon": "fa5_clipboard_check" }, { "id": "g-wild", "label": "No wildcards", "sub": "exact paths only", "kind": "app", "icon": "fa5_ban" }, { "id": "g-env", "label": "Environment match", "sub": "structural", "kind": "app", "icon": "fa5_not_equal" } ] }, { "title": "Measure", "nodes": [ { "id": "g-blast", "label": "Blast-radius diff", "sub": "threshold 40", "kind": "app", "icon": "fa5_sitemap" }, { "id": "g-replay", "label": "Replay 7 days", "sub": "known-good requests", "kind": "app", "icon": "fa5_history" } ] }, { "title": "Approve", "nodes": [ { "id": "g-appr", "label": "Two approvers", "sub": "prod custody · new denies", "kind": "decision", "icon": "fa5_user_check" } ] }, { "title": "Apply", "nodes": [ { "id": "g-apply", "label": "Policy applier", "sub": "only writer of policy", "kind": "app", "icon": "fa5_cogs" } ] }, { "title": "Enforce", "nodes": [ { "id": "g-bao", "label": "OpenBao policies", "sub": "roles · JWT roles", "kind": "security", "icon": "fa5_key" }, { "id": "g-spire", "label": "SPIRE entries", "sub": "selectors · digests", "kind": "security", "icon": "fa5_id_badge" }, { "id": "g-inv", "label": "Inventory", "sub": "reachable sets", "kind": "store", "icon": "postgresql" } ] } ], "edges": [ { "from": "g-apply", "to": "g-bao" }, { "from": "g-apply", "to": "g-spire" }, { "from": "g-apply", "to": "g-inv" } ], "note": "Revert is a Git revert through the same pipeline, with approval waived. No human holds write access to policy in production.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "17-first-issuance", "title": "First Issuance — From Pod Scheduled to First Query", "layout": "sequence", "lifelines": [ { "id": "q-pod", "label": "Pod", "kind": "external", "icon": "kubernetes" }, { "id": "q-agent", "label": "Credential agent", "kind": "app", "icon": "fa5_memory" }, { "id": "q-spa", "label": "SPIRE agent", "kind": "security", "icon": "fa5_fingerprint" }, { "id": "q-gw", "label": "Issuance gateway", "kind": "integration", "icon": "fa5_door_closed" }, { "id": "q-bao", "label": "Broker · OpenBao", "kind": "app", "icon": "fa5_key" }, { "id": "q-pg", "label": "PostgreSQL", "kind": "external", "icon": "postgresql" } ], "messages": [ { "from": "q-pod", "to": "q-agent", "label": "CSI mount: pod UID", "kind": "call" }, { "from": "q-agent", "to": "q-spa", "label": "SVIDs for this pod (delegated)", "kind": "call" }, { "from": "q-spa", "to": "q-spa", "label": "kubelet: namespace · SA · image digest", "kind": "self" }, { "from": "q-spa", "to": "q-agent", "label": "X.509 1 h · JWT 5 min", "kind": "return" }, { "from": "q-agent", "to": "q-gw", "label": "Attest(JWT) over mTLS as the pod", "kind": "call" }, { "from": "q-gw", "to": "q-gw", "label": "bundle · sub = SAN · env · rate", "kind": "self" }, { "from": "q-gw", "to": "q-bao", "label": "jwt login, registered role", "kind": "call" }, { "from": "q-bao", "to": "q-gw", "label": "token 15 min", "kind": "return" }, { "from": "q-gw", "to": "q-agent", "label": "session: key-bound · generation", "kind": "return" }, { "from": "q-agent", "to": "q-gw", "label": "Issue orders-rw · first lane", "kind": "call" }, { "from": "q-gw", "to": "q-bao", "label": "database/creds/orders-rw", "kind": "call" }, { "from": "q-bao", "to": "q-bao", "label": "ACL · audit to local log", "kind": "self" }, { "from": "q-bao", "to": "q-pg", "label": "CREATE ROLE … VALID UNTIL", "kind": "call" }, { "from": "q-pg", "to": "q-bao", "label": "ok", "kind": "return" }, { "from": "q-bao", "to": "q-gw", "label": "user · password · lease 30 min", "kind": "return" }, { "from": "q-gw", "to": "q-agent", "label": "credential · absolute expiry", "kind": "return" }, { "from": "q-agent", "to": "q-pod", "label": "socket ready", "kind": "return" } ], "note": "Target p99 ≤ 400 ms for the attestation exchange and ≤ 500 ms for the mint, most of it spent in CREATE ROLE.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "18-custodial-read", "title": "Custodial Read — Unwrapped Per Read, Recorded Before Release", "layout": "sequence", "lifelines": [ { "id": "c-app", "label": "Application", "kind": "external", "icon": "fa5_cube" }, { "id": "c-agent", "label": "Credential agent", "kind": "app", "icon": "fa5_memory" }, { "id": "c-gw", "label": "Issuance gateway", "kind": "integration", "icon": "fa5_door_closed" }, { "id": "c-cust", "label": "Custody · OpenBao", "kind": "app", "icon": "fa5_lock" }, { "id": "c-kms", "label": "KMS", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "c-aud", "label": "Audit stream", "kind": "queue", "icon": "kafka" } ], "messages": [ { "from": "c-app", "to": "c-agent", "label": "GET partner/payments-key", "kind": "call" }, { "from": "c-agent", "to": "c-agent", "label": "miss, or version changed", "kind": "self" }, { "from": "c-agent", "to": "c-gw", "label": "Read · session", "kind": "call" }, { "from": "c-gw", "to": "c-cust", "label": "kv read as the workload", "kind": "call" }, { "from": "c-cust", "to": "c-gw", "label": "ciphertext v7", "kind": "return" }, { "from": "c-gw", "to": "c-kms", "label": "transit decrypt as gateway", "kind": "call" }, { "from": "c-kms", "to": "c-kms", "label": "own audit device", "kind": "self" }, { "from": "c-kms", "to": "c-gw", "label": "plaintext", "kind": "return" }, { "from": "c-gw", "to": "c-aud", "label": "reader · version · coordinates", "kind": "call" }, { "from": "c-aud", "to": "c-gw", "label": "quorum ack", "kind": "return" }, { "from": "c-gw", "to": "c-agent", "label": "material · version 7", "kind": "return" }, { "from": "c-agent", "to": "c-app", "label": "material · watch armed", "kind": "return" }, { "from": "c-gw", "to": "c-agent", "label": "KMS or ack missing: 503, zeroed", "kind": "error" } ], "note": "No decrypted copy exists anywhere but the agent's memory, and that copy is evicted 60 minutes after it was read.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "19-lease-lifecycle", "title": "Lease Lifecycle — What Ends a Credential When Nobody Revokes It", "layout": "swimlane", "laneHeaderWidth": 170, "stages": [ "Mint", "Renew at ⅔", "Pod deleted", "Session lapses", "Revoked", "Reconcile" ], "lanes": [ { "title": "Credential agent", "cells": [ [ { "label": "Holds lease in memory", "kind": "app", "icon": "fa5_memory" } ], [ { "label": "Renews at 20 min", "kind": "app", "icon": "fa5_sync_alt" } ], [ { "label": "Stops renewing", "kind": "decision", "icon": "fa5_stop_circle" } ], [], [], [] ] }, { "title": "Gateway and broker", "cells": [ [ { "label": "Lease under session", "kind": "app", "icon": "fa5_link" } ], [ { "label": "Extends, ≤ 12 h total", "kind": "app", "icon": "fa5_hourglass_half" } ], [ { "label": "Session still valid", "kind": "decision", "icon": "fa5_hourglass_half" } ], [ { "label": "Token expires ≤ 15 min", "kind": "security", "icon": "fa5_clock" } ], [ { "label": "Child leases revoked", "kind": "security", "icon": "fa5_ban" } ], [] ] }, { "title": "PostgreSQL", "cells": [ [ { "label": "VALID UNTIL T+30", "kind": "external", "icon": "postgresql" } ], [ { "label": "VALID UNTIL moved", "kind": "external", "icon": "postgresql" } ], [ { "label": "Login still possible", "kind": "risk", "icon": "fa5_exclamation_triangle" } ], [], [ { "label": "Killed, then dropped", "kind": "external", "icon": "postgresql" } ], [ { "label": "Account list read", "kind": "external", "icon": "postgresql" } ] ] }, { "title": "Reconciler", "cells": [ [], [], [], [], [ { "label": "Closure confirmed", "kind": "opportunity", "icon": "fa5_check_circle" } ], [ { "label": "Orphans revoked ≤ 90 min", "kind": "app", "icon": "fa5_equals" } ] ] } ], "note": "Three independent clocks end a credential: the session, the lease and the upstream's own VALID UNTIL. Any one is enough.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "20-custodial-rotation", "title": "Custodial Rotation — Two Keys, Observed Use, a Ceiling", "layout": "swimlane", "laneHeaderWidth": 170, "stages": [ "Stage", "Verify", "Promote", "Overlap ≥ 24 h", "Straggler", "Retire" ], "lanes": [ { "title": "Rotation controller", "cells": [ [ { "label": "Requests key 2", "kind": "app", "icon": "fa5_sync_alt" } ], [ { "label": "Test call with key 2", "kind": "decision", "icon": "fa5_vial" } ], [ { "label": "Marks v8 active", "kind": "app", "icon": "fa5_check" } ], [ { "label": "Reads observed use", "kind": "app", "icon": "fa5_eye" } ], [ { "label": "Names it, pages owner", "kind": "decision", "icon": "fa5_bullhorn" } ], [ { "label": "Retires v7 at day 7", "kind": "app", "icon": "fa5_calendar_check" } ] ] }, { "title": "Custody · sites A and B", "cells": [ [ { "label": "v8 staged at both", "kind": "store", "icon": "fa5_lock" } ], [ { "label": "Fail: v7 stays", "kind": "risk", "icon": "fa5_undo" } ], [ { "label": "v8 served, v7 kept", "kind": "store", "icon": "fa5_lock" } ], [], [ { "label": "v7 held", "kind": "store", "icon": "fa5_lock" } ], [ { "label": "v7 destroyed day 37", "kind": "store", "icon": "fa5_trash_alt" } ] ] }, { "title": "Partner API", "cells": [ [ { "label": "Two keys valid", "kind": "external", "icon": "fa5_globe" } ], [ { "label": "Key 2 accepted", "kind": "external", "icon": "fa5_globe" } ], [], [ { "label": "Key 1 traffic falls", "kind": "external", "icon": "fa5_chart_line" } ], [ { "label": "Key 1 still used", "kind": "risk", "icon": "fa5_exclamation_triangle" } ], [ { "label": "Key 1 deleted", "kind": "external", "icon": "fa5_globe" } ] ] }, { "title": "Consumers", "cells": [ [], [], [ { "label": "Agents fetch v8", "kind": "app", "icon": "fa5_memory" } ], [ { "label": "Reload signal", "kind": "app", "icon": "fa5_bell" } ], [ { "label": "Monthly job on v7", "kind": "risk", "icon": "fa5_calendar_alt" } ], [ { "label": "Straggler breaks, named", "kind": "risk", "icon": "fa5_times_circle" } ] ] } ], "note": "Routine rotation retires on observed use with a seven-day ceiling. Emergency rotation skips the overlap and accepts the breakage.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "21-revocation-by-scope", "title": "Revocation by Scope — Contained Means Confirmed at the Upstream", "layout": "flow", "chain": false, "stages": [ { "title": "Name the scope", "nodes": [ { "id": "v-scope", "label": "Scope", "sub": "lease · identity · node · role · all", "kind": "decision", "icon": "fa5_crosshairs" } ] }, { "title": "Resolve", "nodes": [ { "id": "v-inv", "label": "Inventory", "sub": "accessors · prefixes", "kind": "app", "icon": "fa5_sitemap" } ] }, { "title": "Stop new", "nodes": [ { "id": "v-spire", "label": "SPIRE entry or node", "sub": "disabled · evicted", "kind": "security", "icon": "fa5_id_badge" }, { "id": "v-tok", "label": "Sessions revoked", "sub": "no new leases", "kind": "security", "icon": "fa5_door_closed" } ] }, { "title": "End live", "nodes": [ { "id": "v-lease", "label": "Leases revoked", "sub": "synchronous", "kind": "app", "icon": "fa5_key" } ] }, { "title": "At the upstream", "nodes": [ { "id": "v-up", "label": "Terminate, then drop", "sub": "sessions first", "kind": "external", "icon": "postgresql" } ] }, { "title": "Confirm", "nodes": [ { "id": "v-check", "label": "Account gone?", "kind": "decision", "icon": "fa5_search" } ] }, { "title": "Report", "nodes": [ { "id": "v-ok", "label": "Contained", "sub": "p99 ≤ 30 s", "kind": "opportunity", "icon": "fa5_check_circle" }, { "id": "v-bad", "label": "Uncontained", "sub": "retrying · paged", "kind": "risk", "icon": "fa5_exclamation_triangle" } ] } ], "edges": [ { "from": "v-scope", "to": "v-inv" }, { "from": "v-inv", "to": "v-spire" }, { "from": "v-inv", "to": "v-tok" }, { "from": "v-tok", "to": "v-lease" }, { "from": "v-lease", "to": "v-up" }, { "from": "v-up", "to": "v-check" }, { "from": "v-check", "to": "v-ok", "label": "yes" }, { "from": "v-check", "to": "v-bad", "label": "no · 5 min", "kind": "error" } ], "note": "Agents of unaffected workloads re-mint within seconds; the responder chooses scope by the reachable-set preview, not by guesswork.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "22-restart-storm", "title": "Restart Storm — Renewals First, Upstreams Protected", "layout": "swimlane", "laneHeaderWidth": 170, "stages": [ "Pool drains", "Pods reschedule", "Agents attest", "Admission", "Upstream budget", "Settled" ], "lanes": [ { "title": "Credential agents", "cells": [ [ { "label": "Cache dies with node", "kind": "risk", "icon": "fa5_memory" } ], [ { "label": "Empty caches", "kind": "app", "icon": "fa5_memory" } ], [ { "label": "Jitter 0 – 30 s", "kind": "app", "icon": "fa5_random" } ], [ { "label": "Survivors renew", "kind": "app", "icon": "fa5_sync_alt" } ], [ { "label": "Back off on 429", "kind": "app", "icon": "fa5_hourglass_half" } ], [ { "label": "Cache hit ≥ 95%", "kind": "opportunity", "icon": "fa5_check_circle" } ] ] }, { "title": "Issuance gateway", "cells": [ [], [ { "label": "12 instances per site", "kind": "integration", "icon": "fa5_door_closed" } ], [ { "label": "Attest p99 ≤ 400 ms", "kind": "integration", "icon": "fa5_stopwatch" } ], [ { "label": "Renew lane 70% held", "kind": "decision", "icon": "fa5_tachometer_alt" } ], [ { "label": "First-issue queues", "kind": "decision", "icon": "fa5_hourglass_half" } ], [ { "label": "Lanes drained", "kind": "opportunity", "icon": "fa5_check_circle" } ] ] }, { "title": "Broker shards", "cells": [ [], [], [ { "label": "Token writes spike", "kind": "app", "icon": "fa5_key" } ], [ { "label": "Mints admitted", "kind": "app", "icon": "fa5_key" } ], [ { "label": "Role cap holds", "kind": "decision", "icon": "fa5_ban" } ], [ { "label": "Commit p99 ≤ 50 ms", "kind": "opportunity", "icon": "fa5_check_circle" } ] ] }, { "title": "Upstreams", "cells": [ [ { "label": "Old accounts expire", "kind": "external", "icon": "postgresql" } ], [], [], [ { "label": "200 CREATE ROLE / s", "kind": "external", "icon": "postgresql" } ], [ { "label": "Shed before the limit", "kind": "decision", "icon": "fa5_tachometer_alt" } ], [ { "label": "Orphans reconciled", "kind": "external", "icon": "fa5_equals" } ] ] } ], "note": "The storm is bounded by how fast upstreams can create accounts, not by the platform. Sizing therefore starts at the upstream.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "23-control-plane-outage", "title": "Control-Plane Outage at One Site — The Honest Hour", "layout": "grid", "laneHeaderWidth": 180, "columns": [ "0 – 15 min", "15 – 30 min", "30 – 60 min", "Beyond 60 min", "On recovery" ], "rows": [ { "title": "Running workloads", "cells": [ [ { "label": "Served from cache", "kind": "opportunity", "icon": "fa5_memory" } ], [ { "label": "Renewals fail, retried", "kind": "decision", "icon": "fa5_sync_alt" } ], [ { "label": "Leases lapse by age", "kind": "risk", "icon": "fa5_hourglass_end" } ], [ { "label": "Brokered access gone", "kind": "risk", "icon": "fa5_times_circle" } ], [ { "label": "Re-attest with jitter", "kind": "app", "icon": "fa5_random" } ] ] }, { "title": "New pods", "cells": [ [ { "label": "Cannot start", "kind": "risk", "icon": "fa5_ban" } ], [ { "label": "Cannot start", "kind": "risk", "icon": "fa5_ban" } ], [ { "label": "Cannot start", "kind": "risk", "icon": "fa5_ban" } ], [ { "label": "Cannot start", "kind": "risk", "icon": "fa5_ban" } ], [ { "label": "Storm controls on", "kind": "app", "icon": "fa5_tachometer_alt" } ] ] }, { "title": "Custodial material", "cells": [ [ { "label": "Held copy served", "kind": "opportunity", "icon": "fa5_lock" } ], [ { "label": "Held copy served", "kind": "opportunity", "icon": "fa5_lock" } ], [ { "label": "Held copy served", "kind": "opportunity", "icon": "fa5_lock" } ], [ { "label": "Evicted at 60 min", "kind": "risk", "icon": "fa5_trash_alt" } ], [ { "label": "Version checked", "kind": "app", "icon": "fa5_check" } ] ] }, { "title": "Containment", "cells": [ [ { "label": "Expiry still runs", "kind": "opportunity", "icon": "fa5_hourglass_half" } ], [ { "label": "Upstream VALID UNTIL", "kind": "opportunity", "icon": "postgresql" } ], [ { "label": "No revocation path", "kind": "risk", "icon": "fa5_exclamation_triangle" } ], [ { "label": "Everything expired", "kind": "opportunity", "icon": "fa5_check_circle" } ], [ { "label": "Pending revokes replay", "kind": "app", "icon": "fa5_redo" } ] ] }, { "title": "Operators", "cells": [ [ { "label": "No grace switch exists", "kind": "decision", "icon": "fa5_ban" } ], [ { "label": "Restore site quorum", "kind": "app", "icon": "fa5_tools" } ], [ { "label": "Estate impact declared", "kind": "decision", "icon": "fa5_bullhorn" } ], [ { "label": "Other site unaffected", "kind": "opportunity", "icon": "fa5_building" } ], [ { "label": "Reconcile before open", "kind": "app", "icon": "fa5_equals" } ] ] } ], "note": "This is the availability price of short leases, stated rather than engineered away. The target that prevents it is 99.99% and an RTO of 10 minutes.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "24-restore-without-revival", "title": "Store Restore — Nothing Revoked Comes Back", "layout": "sequence", "lifelines": [ { "id": "x-sre", "label": "Platform SRE", "kind": "actor", "icon": "fa5_user_cog" }, { "id": "x-bao", "label": "Broker · restored", "kind": "app", "icon": "fa5_key" }, { "id": "x-kms", "label": "KMS", "kind": "security", "icon": "fa5_shield_alt" }, { "id": "x-gw", "label": "Issuance gateway", "kind": "integration", "icon": "fa5_door_closed" }, { "id": "x-rec", "label": "Reconciler", "kind": "app", "icon": "fa5_equals" }, { "id": "x-up", "label": "Upstreams", "kind": "external", "icon": "postgresql" } ], "messages": [ { "from": "x-sre", "to": "x-bao", "label": "restore Raft snapshot from T–40 min", "kind": "call" }, { "from": "x-sre", "to": "x-kms", "label": "advance generation 41 → 42 (two people)", "kind": "call" }, { "from": "x-gw", "to": "x-kms", "label": "read generation", "kind": "call" }, { "from": "x-gw", "to": "x-gw", "label": "partition closed · sessions < 42 refused", "kind": "self" }, { "from": "x-rec", "to": "x-bao", "label": "list restored leases", "kind": "call" }, { "from": "x-rec", "to": "x-up", "label": "list platform accounts", "kind": "call" }, { "from": "x-up", "to": "x-rec", "label": "accounts present now", "kind": "return" }, { "from": "x-rec", "to": "x-bao", "label": "close leases with no account", "kind": "call" }, { "from": "x-rec", "to": "x-up", "label": "drop accounts with no lease", "kind": "call" }, { "from": "x-rec", "to": "x-bao", "label": "custody versions vs rotation ledger", "kind": "call" }, { "from": "x-bao", "to": "x-rec", "label": "rolled-back versions quarantined", "kind": "return" }, { "from": "x-rec", "to": "x-gw", "label": "partition revalidated", "kind": "call" }, { "from": "x-gw", "to": "x-gw", "label": "open · agents re-attest", "kind": "self" } ], "note": "The generation lives in the KMS cluster, which is never restored alongside the store it protects. The rotation ledger lives in the audit store.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "25-deployment-architecture", "title": "Deployment — Two Sites, Nothing Quorums Across Them", "layout": "nested", "boxes": [ { "title": "Site A", "kind": "onprem", "dir": "col", "children": [ { "title": "Production enclave · three rooms · bare metal", "kind": "trust", "dir": "row", "nodes": [ { "label": "KMS", "sub": "3 hosts · 2 HSMs", "kind": "security", "icon": "fa5_shield_alt" }, { "label": "Custody", "sub": "5 hosts", "kind": "app", "icon": "fa5_lock" }, { "label": "Broker shards", "sub": "2 × 5 hosts", "kind": "app", "icon": "fa5_key" }, { "label": "Gateway · SPIRE", "sub": "6 + 3 + 3 hosts", "kind": "integration", "icon": "fa5_door_closed" } ] }, { "title": "Shared services · site A", "kind": "boundary", "dir": "row", "nodes": [ { "label": "Non-prod partitions", "sub": "staging · dev · VMs", "kind": "app", "icon": "fa5_server" }, { "label": "Audit Kafka · ClickHouse", "sub": "3 + 3 hosts", "kind": "queue", "icon": "kafka" }, { "label": "Governance cluster", "sub": "Kubernetes · 3 hosts", "kind": "platform", "icon": "kubernetes" } ] }, { "title": "Estate · site A", "kind": "boundary", "dir": "row", "nodes": [ { "label": "Estate clusters", "sub": "agent DaemonSets", "kind": "external", "icon": "kubernetes" } ] } ] }, { "title": "Site B", "kind": "onprem", "dir": "col", "children": [ { "title": "Production enclave · three rooms · bare metal", "kind": "trust", "dir": "row", "nodes": [ { "label": "KMS", "sub": "own keys · 2 HSMs", "kind": "security", "icon": "fa5_shield_alt" }, { "label": "Custody", "sub": "5 hosts", "kind": "app", "icon": "fa5_lock" }, { "label": "Broker shards", "sub": "2 × 5 hosts", "kind": "app", "icon": "fa5_key" }, { "label": "Gateway · SPIRE", "sub": "6 + 3 + 3 hosts", "kind": "integration", "icon": "fa5_door_closed" } ] }, { "title": "Shared services · site B", "kind": "boundary", "dir": "row", "nodes": [ { "label": "Staging partition", "sub": "VMs", "kind": "app", "icon": "fa5_server" }, { "label": "Audit Kafka · ClickHouse", "sub": "3 + 3 hosts", "kind": "queue", "icon": "kafka" }, { "label": "Records Ceph", "sub": "Object Lock · records team", "kind": "store", "icon": "fa5_archive" } ] }, { "title": "Estate · site B", "kind": "boundary", "dir": "row", "nodes": [ { "label": "Estate clusters", "sub": "agent DaemonSets", "kind": "external", "icon": "kubernetes" } ] } ] } ], "outside": [ { "label": "Offline root CAs", "sub": "safe · ceremony yearly", "kind": "security", "icon": "fa5_microchip" }, { "label": "Corporate IdP", "sub": "operators only", "kind": "external", "icon": "fa5_id_card" } ], "note": "Only three things cross sites: custodial ciphertext written to both, audit replication, and people. No quorum, lease or session spans two sites.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "26-release-pipeline", "title": "Release Pipeline — Partition by Partition, Site by Site", "layout": "flow", "chain": true, "stages": [ { "title": "Source", "nodes": [ { "id": "rp-git", "label": "Forgejo", "sub": "signed commits", "kind": "store", "icon": "git" } ] }, { "title": "Build", "nodes": [ { "id": "rp-build", "label": "Reproducible build", "sub": "Go · OpenBao pinned", "kind": "app", "icon": "fa5_cogs" }, { "id": "rp-sign", "label": "cosign · SBOM", "sub": "provenance", "kind": "security", "icon": "fa5_file_signature" } ] }, { "title": "Prove", "nodes": [ { "id": "rp-inv", "label": "Invariant suite", "sub": "no extension · no env var", "kind": "app", "icon": "fa5_clipboard_check" }, { "id": "rp-scrub", "label": "Material scrubber", "sub": "logs · traces · errors", "kind": "app", "icon": "fa5_eye_slash" }, { "id": "rp-storm", "label": "Storm replay", "sub": "25,000 rps · 120 s", "kind": "app", "icon": "fa5_tachometer_alt" } ] }, { "title": "Non-production", "nodes": [ { "id": "rp-stg", "label": "Staging partitions", "sub": "both sites · 48 h soak", "kind": "app", "icon": "fa5_server" } ] }, { "title": "Production A", "nodes": [ { "id": "rp-a", "label": "One partition", "sub": "one node at a time", "kind": "decision", "icon": "ansible" } ] }, { "title": "Production B", "nodes": [ { "id": "rp-b", "label": "Site B", "sub": "after 24 h clean", "kind": "decision", "icon": "ansible" } ] }, { "title": "Estate agents", "nodes": [ { "id": "rp-agent", "label": "Agent DaemonSet", "sub": "1% → 10% → all", "kind": "app", "icon": "argocd" } ] } ], "note": "Enclave hosts are changed by Ansible from artefacts already staged on the host. Nothing on the issuance path pulls from a network at deploy time.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "27-observability", "title": "Observability — What Is Watched, Where, and Who It Wakes", "layout": "grid", "laneHeaderWidth": 170, "columns": [ "Collected from", "Kept in", "Alert on", "Who sees it" ], "rows": [ { "title": "Issuance health", "cells": [ [ { "label": "Gateway · OpenBao", "kind": "app", "icon": "fa5_door_closed" } ], [ { "label": "Prometheus · 13 mo", "kind": "store", "icon": "prometheus" } ], [ { "label": "Renewal failure > 0.1%", "kind": "risk", "icon": "fa5_bell" } ], [ { "label": "Platform SRE", "kind": "actor", "icon": "fa5_user_cog" } ] ] }, { "title": "Containment", "cells": [ [ { "label": "Revocations · reconciler", "kind": "app", "icon": "fa5_equals" } ], [ { "label": "Prometheus · ClickHouse", "kind": "store", "icon": "clickhouse" } ], [ { "label": "Any uncontained lease", "kind": "risk", "icon": "fa5_bell" } ], [ { "label": "Security on call", "kind": "actor", "icon": "fa5_user_shield" } ] ] }, { "title": "Posture", "cells": [ [ { "label": "Inventory", "kind": "app", "icon": "fa5_sitemap" } ], [ { "label": "PostgreSQL · weekly", "kind": "store", "icon": "postgresql" } ], [ { "label": "Past 80% of max age", "kind": "decision", "icon": "fa5_hourglass_end" } ], [ { "label": "Secret owners", "kind": "actor", "icon": "fa5_user_tag" } ] ] }, { "title": "Continuity", "cells": [ [ { "label": "Agents", "kind": "app", "icon": "fa5_memory" } ], [ { "label": "Prometheus", "kind": "store", "icon": "prometheus" } ], [ { "label": "Cache hit < 90%", "kind": "decision", "icon": "fa5_chart_line" } ], [ { "label": "Platform SRE", "kind": "actor", "icon": "fa5_user_cog" } ] ] }, { "title": "Logs", "cells": [ [ { "label": "Every component", "kind": "app", "icon": "fa5_file_alt" } ], [ { "label": "Loki · scrubbed · 30 d", "kind": "store", "icon": "loki" } ], [ { "label": "Scrubber hit", "kind": "risk", "icon": "fa5_bell" } ], [ { "label": "Security on call", "kind": "actor", "icon": "fa5_user_shield" } ] ] }, { "title": "Outside-in", "cells": [ [ { "label": "Synthetic workload", "kind": "app", "icon": "fa5_heartbeat" } ], [ { "label": "Prometheus · other site", "kind": "store", "icon": "prometheus" } ], [ { "label": "Mint fails 2 min", "kind": "risk", "icon": "fa5_bell" } ], [ { "label": "Platform SRE", "kind": "actor", "icon": "fa5_user_cog" } ] ] } ], "note": "Metrics are labelled by role and secret path, never by value. Traces stop at the gateway; no span carries a request or response body.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "28-lifetime-economics", "title": "Lease Lifetime Economics — Every Choice Has a Number", "layout": "grid", "laneHeaderWidth": 190, "columns": [ "15 min · irrevocable", "30 min · default", "60 min · maximum", "12 h · refused" ], "rows": [ { "title": "Renewals per site", "cells": [ [ { "label": "None · re-mint", "kind": "decision", "icon": "fa5_sync_alt" } ], [ { "label": "≈ 150 / s", "kind": "opportunity", "icon": "fa5_sync_alt" } ], [ { "label": "≈ 75 / s", "kind": "opportunity", "icon": "fa5_sync_alt" } ], [ { "label": "≈ 4 / s", "kind": "opportunity", "icon": "fa5_sync_alt" } ] ] }, { "title": "Account churn", "cells": [ [ { "label": "≈ 300 CREATE / s", "kind": "risk", "icon": "postgresql" } ], [ { "label": "≈ 4 / s at 12 h", "kind": "opportunity", "icon": "postgresql" } ], [ { "label": "≈ 4 / s at 12 h", "kind": "opportunity", "icon": "postgresql" } ], [ { "label": "≈ 4 / s", "kind": "opportunity", "icon": "postgresql" } ] ] }, { "title": "Exposure, holder dead", "cells": [ [ { "label": "≤ 15 min", "kind": "opportunity", "icon": "fa5_hourglass_half" } ], [ { "label": "≤ 30 min", "kind": "opportunity", "icon": "fa5_hourglass_half" } ], [ { "label": "≤ 60 min", "kind": "decision", "icon": "fa5_hourglass_half" } ], [ { "label": "≤ 12 h", "kind": "risk", "icon": "fa5_hourglass_end" } ] ] }, { "title": "Exposure, holder alive", "cells": [ [ { "label": "≤ 15 min", "kind": "opportunity", "icon": "fa5_hourglass_half" } ], [ { "label": "≤ 12 h total", "kind": "risk", "icon": "fa5_hourglass_end" } ], [ { "label": "≤ 12 h total", "kind": "risk", "icon": "fa5_hourglass_end" } ], [ { "label": "≤ 12 h", "kind": "risk", "icon": "fa5_hourglass_end" } ] ] }, { "title": "Outage continuity", "cells": [ [ { "label": "≤ 15 min", "kind": "risk", "icon": "fa5_memory" } ], [ { "label": "≤ 30 min", "kind": "decision", "icon": "fa5_memory" } ], [ { "label": "≤ 60 min", "kind": "opportunity", "icon": "fa5_memory" } ], [ { "label": "≤ 12 h", "kind": "opportunity", "icon": "fa5_memory" } ] ] }, { "title": "Audit rows per day", "cells": [ [ { "label": "≈ 26 M", "kind": "risk", "icon": "clickhouse" } ], [ { "label": "≈ 13 M", "kind": "decision", "icon": "clickhouse" } ], [ { "label": "≈ 7 M", "kind": "opportunity", "icon": "clickhouse" } ], [ { "label": "≈ 0.4 M", "kind": "opportunity", "icon": "clickhouse" } ] ] } ], "note": "Per site, for 180,000 outstanding leases renewed at two-thirds of their lifetime. The irrevocable column assumes every lease were in that class, which none should be.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "29-roadmap", "title": "Roadmap — Proof, MVP, Then Breadth", "layout": "flow", "chain": true, "stages": [ { "title": "Proof · 8 weeks", "nodes": [ { "label": "HSM seal on release", "kind": "decision", "icon": "fa5_microchip" }, { "label": "Broker write ceiling", "kind": "decision", "icon": "fa5_tachometer_alt" }, { "label": "Delegated SVIDs at 110 pods", "kind": "decision", "icon": "fa5_fingerprint" } ] }, { "title": "MVP", "nodes": [ { "label": "Attestation · sessions", "kind": "app", "icon": "fa5_id_badge" }, { "label": "PostgreSQL · RabbitMQ", "kind": "app", "icon": "postgresql" }, { "label": "Custody · socket delivery", "kind": "app", "icon": "fa5_lock" }, { "label": "Audit before return", "kind": "app", "icon": "kafka" }, { "label": "Production at both sites", "kind": "decision", "icon": "fa5_building" } ] }, { "title": "Phase 2", "nodes": [ { "label": "Rotation with overlap", "kind": "app", "icon": "fa5_sync_alt" }, { "label": "File and proxy delivery", "kind": "app", "icon": "envoy" }, { "label": "Break-glass · blast reports", "kind": "app", "icon": "fa5_user_lock" }, { "label": "More upstreams · irrevocable", "kind": "app", "icon": "fa5_plug" } ] }, { "title": "Phase 3", "nodes": [ { "label": "TPM attestation · VMs · CI", "kind": "app", "icon": "fa5_microchip" }, { "label": "Leak detection · decoys", "kind": "app", "icon": "fa5_eye" }, { "label": "Federation replaces brokering", "kind": "opportunity", "icon": "fa5_handshake" } ] } ], "note": "Multi-site moves from Phase 2 into the MVP. The MVP may serve staging from one site; it serves production only from two.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "30-exception-register-loop", "title": "The Exception Register — How Static Credentials Leave the Estate", "layout": "cycle", "centre": { "label": "Exception register", "icon": "fa5_list_alt" }, "nodes": [ { "id": "x1", "label": "Found", "sub": "scanner · migration", "kind": "risk", "icon": "fa5_search" }, { "id": "x2", "label": "Registered", "sub": "owner · review date", "kind": "app", "icon": "fa5_list_alt" }, { "id": "x3", "label": "Bounded", "sub": "single use · short lease", "kind": "security", "icon": "fa5_hourglass_half" }, { "id": "x4", "label": "Reviewed", "sub": "quarterly", "kind": "decision", "icon": "fa5_calendar_check" }, { "id": "x5", "label": "Migrated", "sub": "attested or brokered", "kind": "app", "icon": "fa5_exchange_alt" }, { "id": "x6", "label": "Closed", "sub": "verified absent", "kind": "opportunity", "icon": "fa5_check_circle" } ], "ringLabels": [ "owner named", "limit applied", "due date", "plan funded", "scan clean", "next finding" ], "rx": 420, "ry": 210, "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "31-security-trust-zones", "title": "Security — Trust Zones and What Crosses Them", "layout": "zones", "zones": [ { "title": "Estate workloads", "kind": "trust", "nodes": [ { "id": "z-pod", "label": "Workload pod", "sub": "no platform address", "kind": "external", "icon": "kubernetes" }, { "id": "z-agent", "label": "Credential agent", "sub": "node daemon", "kind": "app", "icon": "fa5_memory" } ] }, { "title": "Enclave edge", "kind": "trust", "nodes": [ { "id": "z-gw", "label": "Issuance gateway", "sub": "only listener", "kind": "integration", "icon": "fa5_door_closed" }, { "id": "z-acc", "label": "Access broker", "sub": "humans only", "kind": "security", "icon": "fa5_user_lock" } ] }, { "title": "Engines", "kind": "trust", "nodes": [ { "id": "z-broker", "label": "Broker shards", "sub": "admin credentials", "kind": "app", "icon": "fa5_key" }, { "id": "z-cust", "label": "Custody", "sub": "ciphertext only", "kind": "app", "icon": "fa5_lock" } ] }, { "title": "Root of trust", "kind": "trust", "nodes": [ { "id": "z-kms", "label": "KMS", "sub": "custodians' team", "kind": "security", "icon": "fa5_shield_alt" } ] }, { "title": "Record", "kind": "trust", "nodes": [ { "id": "z-arch", "label": "Audit archive", "sub": "records team", "kind": "store", "icon": "fa5_archive" } ] } ], "edges": [ { "from": "z-pod", "to": "z-agent", "label": "local socket" }, { "from": "z-agent", "to": "z-gw", "label": "mTLS · SVID" }, { "from": "z-gw", "to": "z-broker", "label": "token · mTLS" }, { "from": "z-acc", "to": "z-cust", "label": "wrapped, single use" }, { "from": "z-cust", "to": "z-kms", "kind": "batch" }, { "from": "z-gw", "to": "z-kms", "label": "unwrap per read", "route": "gutter" }, { "from": "z-kms", "to": "z-arch", "label": "audit", "kind": "async" } ], "note": "The dotted line is auto-unseal at start-up. Platform operators hold no role in the root-of-trust or record zones; the gateway is the only enclave listener the estate can reach.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "32-blast-radius-by-compromise", "title": "Blast Radius — What Each Compromise Yields, and What It Does Not", "layout": "grid", "laneHeaderWidth": 190, "columns": [ "Yields", "Does not yield", "Bounded by" ], "rows": [ { "title": "One workload pod", "cells": [ [ { "label": "Its own grants", "kind": "risk", "icon": "fa5_key" } ], [ { "label": "Any other identity", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Lease · 12 h total", "kind": "decision", "icon": "fa5_hourglass_half" } ] ] }, { "title": "One node, root", "cells": [ [ { "label": "Grants of pods on it", "kind": "risk", "icon": "fa5_server" } ], [ { "label": "Pods on other nodes", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Node eviction · expiry", "kind": "decision", "icon": "fa5_id_badge" } ] ] }, { "title": "Gateway instance", "cells": [ [ { "label": "Material in flight", "kind": "risk", "icon": "fa5_door_closed" } ], [ { "label": "Stored material · admin creds", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Unwrap audit in KMS", "kind": "decision", "icon": "fa5_receipt" } ] ] }, { "title": "Broker shard", "cells": [ [ { "label": "Its upstream admins", "kind": "risk", "icon": "fa5_key" } ], [ { "label": "Custodial · other env", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Daily root rotation", "kind": "decision", "icon": "fa5_sync_alt" } ] ] }, { "title": "Custody cluster", "cells": [ [ { "label": "Ciphertext only", "kind": "decision", "icon": "fa5_lock" } ], [ { "label": "Any plaintext", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Separate KMS", "kind": "decision", "icon": "fa5_shield_alt" } ] ] }, { "title": "KMS cluster", "cells": [ [ { "label": "Keys, no ciphertext", "kind": "decision", "icon": "fa5_shield_alt" } ], [ { "label": "Material without custody", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Separate team · HSM", "kind": "decision", "icon": "fa5_microchip" } ] ] }, { "title": "Disks and snapshots", "cells": [ [ { "label": "Nothing readable", "kind": "opportunity", "icon": "fa5_hdd" } ], [ { "label": "Keys or plaintext", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Barrier plus envelope", "kind": "decision", "icon": "fa5_lock" } ] ] }, { "title": "Platform operator", "cells": [ [ { "label": "Outage, not a read", "kind": "decision", "icon": "fa5_user_cog" } ], [ { "label": "Material · audit edits", "kind": "opportunity", "icon": "fa5_ban" } ], [ { "label": "Two-person break-glass", "kind": "decision", "icon": "fa5_user_lock" } ] ] } ], "note": "The inventory computes the first column per identity and per node from compiled policy. This page is its summary by component.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "33-break-glass-read", "title": "Break-Glass Read — Two People, a Reason, One Use", "layout": "sequence", "lifelines": [ { "id": "b-op", "label": "Responder", "kind": "actor", "icon": "fa5_user_shield" }, { "id": "b-kc", "label": "Keycloak", "kind": "security", "icon": "keycloak" }, { "id": "b-acc", "label": "Access broker", "kind": "security", "icon": "fa5_user_lock" }, { "id": "b-app", "label": "Second approver", "kind": "actor", "icon": "fa5_user_check" }, { "id": "b-cust", "label": "Custody · via gateway", "kind": "app", "icon": "fa5_lock" }, { "id": "b-aud", "label": "Audit and paging", "kind": "queue", "icon": "kafka" } ], "messages": [ { "from": "b-op", "to": "b-kc", "label": "sign in · WebAuthn", "kind": "call" }, { "from": "b-kc", "to": "b-op", "label": "ID token 10 min", "kind": "return" }, { "from": "b-op", "to": "b-acc", "label": "request: secret · reason · incident", "kind": "call" }, { "from": "b-acc", "to": "b-aud", "label": "request recorded (sync)", "kind": "call" }, { "from": "b-acc", "to": "b-app", "label": "approve? not the requester", "kind": "call" }, { "from": "b-app", "to": "b-acc", "label": "approved · WebAuthn", "kind": "return" }, { "from": "b-acc", "to": "b-cust", "label": "read, response-wrapped", "kind": "call" }, { "from": "b-cust", "to": "b-acc", "label": "wrapping token · 1 use · 15 min", "kind": "return" }, { "from": "b-acc", "to": "b-op", "label": "wrapping token", "kind": "return" }, { "from": "b-op", "to": "b-cust", "label": "unwrap once", "kind": "call" }, { "from": "b-cust", "to": "b-aud", "label": "incident-grade event · pages security", "kind": "async" }, { "from": "b-cust", "to": "b-op", "label": "material", "kind": "return" }, { "from": "b-acc", "to": "b-acc", "label": "secret flagged for rotation", "kind": "self" } ], "note": "A wrapping token unwrapped by anyone else fails for the responder, which is itself the alarm. Every break-glass read schedules an emergency rotation.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } }, { "id": "34-failure-modes", "title": "Failure Modes — Detected, Contained, and What the Estate Sees", "layout": "grid", "laneHeaderWidth": 200, "columns": [ "Detected by", "Contained by", "What the estate sees" ], "rows": [ { "title": "Gateway instance lost", "cells": [ [ { "label": "Agent health checks", "kind": "app", "icon": "fa5_heartbeat" } ], [ { "label": "Client-side retry", "kind": "decision", "icon": "fa5_redo" } ], [ { "label": "Nothing", "kind": "opportunity", "icon": "fa5_check_circle" } ] ] }, { "title": "Broker leader lost", "cells": [ [ { "label": "Raft election", "kind": "app", "icon": "fa5_key" } ], [ { "label": "Standby promoted", "kind": "decision", "icon": "fa5_sync_alt" } ], [ { "label": "Seconds of 503, retried", "kind": "decision", "icon": "fa5_hourglass_half" } ] ] }, { "title": "KMS unavailable", "cells": [ [ { "label": "Unwrap errors", "kind": "app", "icon": "fa5_shield_alt" } ], [ { "label": "Custodial fail closed", "kind": "decision", "icon": "fa5_ban" } ], [ { "label": "Brokered unaffected", "kind": "opportunity", "icon": "fa5_check_circle" } ] ] }, { "title": "SPIRE server lost", "cells": [ [ { "label": "SVID renewal errors", "kind": "app", "icon": "fa5_id_badge" } ], [ { "label": "SVIDs valid 1 h", "kind": "decision", "icon": "fa5_hourglass_half" } ], [ { "label": "No new pods after 30 min", "kind": "risk", "icon": "fa5_ban" } ] ] }, { "title": "Upstream refuses mint", "cells": [ [ { "label": "Mint error rate", "kind": "app", "icon": "postgresql" } ], [ { "label": "Distinct retryable error", "kind": "decision", "icon": "fa5_redo" } ], [ { "label": "That role's new pods wait", "kind": "risk", "icon": "fa5_hourglass_half" } ] ] }, { "title": "Revocation fails", "cells": [ [ { "label": "Upstream check", "kind": "app", "icon": "fa5_search" } ], [ { "label": "VALID UNTIL · retries", "kind": "decision", "icon": "fa5_redo" } ], [ { "label": "Reported uncontained", "kind": "risk", "icon": "fa5_exclamation_triangle" } ] ] }, { "title": "Audit sink down", "cells": [ [ { "label": "Producer acks fail", "kind": "app", "icon": "kafka" } ], [ { "label": "Posture per class", "kind": "decision", "icon": "fa5_balance_scale" } ], [ { "label": "Custodial reads 503", "kind": "risk", "icon": "fa5_ban" } ] ] }, { "title": "Bad policy push", "cells": [ [ { "label": "Replay diff · deny rate", "kind": "app", "icon": "fa5_history" } ], [ { "label": "Git revert, no approval", "kind": "decision", "icon": "fa5_undo" } ], [ { "label": "Minutes of 403 at worst", "kind": "risk", "icon": "fa5_ban" } ] ] }, { "title": "Agent clock skew", "cells": [ [ { "label": "Gateway Date · chrony", "kind": "app", "icon": "fa5_clock" } ], [ { "label": "Agent refuses > 30 s", "kind": "decision", "icon": "fa5_ban" } ], [ { "label": "Node cordoned", "kind": "risk", "icon": "fa5_server" } ] ] }, { "title": "Consumer misses rotation", "cells": [ [ { "label": "Observed use of old", "kind": "app", "icon": "fa5_eye" } ], [ { "label": "Retirement held ≤ 7 d", "kind": "decision", "icon": "fa5_calendar_alt" } ], [ { "label": "Straggler named", "kind": "decision", "icon": "fa5_bullhorn" } ] ] } ], "note": "Regional outage, restart storm and store restore each have their own view: 23, 22 and 24.", "meta": { "v": "1.0", "owner": "Security Platform Architecture", "date": "2026-09" } } ]